target/i386/hvf/hvf.c

   1 /* Copyright 2008 IBM Corporation
   2  *           2008 Red Hat, Inc.
   3  * Copyright 2011 Intel Corporation
   4  * Copyright 2016 Veertu, Inc.
   5  * Copyright 2017 The Android Open Source Project
   6  *
   7  * QEMU Hypervisor.framework support
   8  *
   9  * This program is free software; you can redistribute it and/or
  10  * modify it under the terms of version 2 of the GNU General Public
  11  * License as published by the Free Software Foundation.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  *
  21  * This file contain code under public domain from the hvdos project:
  22  * https://github.com/mist64/hvdos
  23  *
  24  * Parts Copyright (c) 2011 NetApp, Inc.
  25  * All rights reserved.
  26  *
  27  * Redistribution and use in source and binary forms, with or without
  28  * modification, are permitted provided that the following conditions
  29  * are met:
  30  * 1. Redistributions of source code must retain the above copyright
  31  *    notice, this list of conditions and the following disclaimer.
  32  * 2. Redistributions in binary form must reproduce the above copyright
  33  *    notice, this list of conditions and the following disclaimer in the
  34  *    documentation and/or other materials provided with the distribution.
  35  *
  36  * THIS SOFTWARE IS PROVIDED BY NETAPP, INC ``AS IS'' AND
  37  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  38  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  39  * ARE DISCLAIMED.  IN NO EVENT SHALL NETAPP, INC OR CONTRIBUTORS BE LIABLE
  40  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  41  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  42  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  43  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  44  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  45  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  46  * SUCH DAMAGE.
  47  */
  48
  49 #include "qemu/osdep.h"
  50 #include "qemu-common.h"
  51 #include "qemu/error-report.h"
  52
  53 #include "sysemu/hvf.h"
  54 #include "sysemu/hvf_int.h"
  55 #include "sysemu/runstate.h"
  56 #include "hvf-i386.h"
  57 #include "vmcs.h"
  58 #include "vmx.h"
  59 #include "x86.h"
  60 #include "x86_descr.h"
  61 #include "x86_mmu.h"
  62 #include "x86_decode.h"
  63 #include "x86_emu.h"
  64 #include "x86_task.h"
  65 #include "x86hvf.h"
  66
  67 #include <Hypervisor/hv.h>
  68 #include <Hypervisor/hv_vmx.h>
  69 #include <sys/sysctl.h>
  70
  71 #include "hw/i386/apic_internal.h"
  72 #include "qemu/main-loop.h"
  73 #include "qemu/accel.h"
  74 #include "target/i386/cpu.h"
  75
  76 void vmx_update_tpr(CPUState *cpu)
  77 {
  78     /* TODO: need integrate APIC handling */
  79     X86CPU *x86_cpu = X86_CPU(cpu);
  80     int tpr = cpu_get_apic_tpr(x86_cpu->apic_state) << 4;
  81     int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
  82
  83     wreg(cpu->hvf_fd, HV_X86_TPR, tpr);
  84     if (irr == -1) {
  85         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
  86     } else {
  87         wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, (irr > tpr) ? tpr >> 4 :
  88               irr >> 4);
  89     }
  90 }
  91
  92 static void update_apic_tpr(CPUState *cpu)
  93 {
  94     X86CPU *x86_cpu = X86_CPU(cpu);
  95     int tpr = rreg(cpu->hvf_fd, HV_X86_TPR) >> 4;
  96     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
  97 }
  98
  99 #define VECTORING_INFO_VECTOR_MASK     0xff
 100
 101 void hvf_handle_io(CPUArchState *env, uint16_t port, void *buffer,
 102                   int direction, int size, int count)
 103 {
 104     int i;
 105     uint8_t *ptr = buffer;
 106
 107     for (i = 0; i < count; i++) {
 108         address_space_rw(&address_space_io, port, MEMTXATTRS_UNSPECIFIED,
 109                          ptr, size,
 110                          direction);
 111         ptr += size;
 112     }
 113 }
 114
 115 static bool ept_emulation_fault(hvf_slot *slot, uint64_t gpa, uint64_t ept_qual)
 116 {
 117     int read, write;
 118
 119     /* EPT fault on an instruction fetch doesn't make sense here */
 120     if (ept_qual & EPT_VIOLATION_INST_FETCH) {
 121         return false;
 122     }
 123
 124     /* EPT fault must be a read fault or a write fault */
 125     read = ept_qual & EPT_VIOLATION_DATA_READ ? 1 : 0;
 126     write = ept_qual & EPT_VIOLATION_DATA_WRITE ? 1 : 0;
 127     if ((read | write) == 0) {
 128         return false;
 129     }
 130
 131     if (write && slot) {
 132         if (slot->flags & HVF_SLOT_LOG) {
 133             memory_region_set_dirty(slot->region, gpa - slot->start, 1);
 134             hv_vm_protect((hv_gpaddr_t)slot->start, (size_t)slot->size,
 135                           HV_MEMORY_READ | HV_MEMORY_WRITE);
 136         }
 137     }
 138
 139     /*
 140      * The EPT violation must have been caused by accessing a
 141      * guest-physical address that is a translation of a guest-linear
 142      * address.
 143      */
 144     if ((ept_qual & EPT_VIOLATION_GLA_VALID) == 0 ||
 145         (ept_qual & EPT_VIOLATION_XLAT_VALID) == 0) {
 146         return false;
 147     }
 148
 149     if (!slot) {
 150         return true;
 151     }
 152     if (!memory_region_is_ram(slot->region) &&
 153         !(read && memory_region_is_romd(slot->region))) {
 154         return true;
 155     }
 156     return false;
 157 }
 158
 159 void hvf_arch_vcpu_destroy(CPUState *cpu)
 160 {
 161     X86CPU *x86_cpu = X86_CPU(cpu);
 162     CPUX86State *env = &x86_cpu->env;
 163
 164     g_free(env->hvf_mmio_buf);
 165 }
 166
 167 static void init_tsc_freq(CPUX86State *env)
 168 {
 169     size_t length;
 170     uint64_t tsc_freq;
 171
 172     if (env->tsc_khz != 0) {
 173         return;
 174     }
 175
 176     length = sizeof(uint64_t);
 177     if (sysctlbyname("machdep.tsc.frequency", &tsc_freq, &length, NULL, 0)) {
 178         return;
 179     }
 180     env->tsc_khz = tsc_freq / 1000;  /* Hz to KHz */
 181 }
 182
 183 static void init_apic_bus_freq(CPUX86State *env)
 184 {
 185     size_t length;
 186     uint64_t bus_freq;
 187
 188     if (env->apic_bus_freq != 0) {
 189         return;
 190     }
 191
 192     length = sizeof(uint64_t);
 193     if (sysctlbyname("hw.busfrequency", &bus_freq, &length, NULL, 0)) {
 194         return;
 195     }
 196     env->apic_bus_freq = bus_freq;
 197 }
 198
 199 static inline bool tsc_is_known(CPUX86State *env)
 200 {
 201     return env->tsc_khz != 0;
 202 }
 203
 204 static inline bool apic_bus_freq_is_known(CPUX86State *env)
 205 {
 206     return env->apic_bus_freq != 0;
 207 }
 208
 209 int hvf_arch_init_vcpu(CPUState *cpu)
 210 {
 211     X86CPU *x86cpu = X86_CPU(cpu);
 212     CPUX86State *env = &x86cpu->env;
 213
 214     init_emu();
 215     init_decoder();
 216
 217     hvf_state->hvf_caps = g_new0(struct hvf_vcpu_caps, 1);
 218     env->hvf_mmio_buf = g_new(char, 4096);
 219
 220     if (x86cpu->vmware_cpuid_freq) {
 221         init_tsc_freq(env);
 222         init_apic_bus_freq(env);
 223
 224         if (!tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
 225             error_report("vmware-cpuid-freq: feature couldn't be enabled");
 226         }
 227     }
 228
 229     if (hv_vmx_read_capability(HV_VMX_CAP_PINBASED,
 230         &hvf_state->hvf_caps->vmx_cap_pinbased)) {
 231         abort();
 232     }
 233     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED,
 234         &hvf_state->hvf_caps->vmx_cap_procbased)) {
 235         abort();
 236     }
 237     if (hv_vmx_read_capability(HV_VMX_CAP_PROCBASED2,
 238         &hvf_state->hvf_caps->vmx_cap_procbased2)) {
 239         abort();
 240     }
 241     if (hv_vmx_read_capability(HV_VMX_CAP_ENTRY,
 242         &hvf_state->hvf_caps->vmx_cap_entry)) {
 243         abort();
 244     }
 245
 246     /* set VMCS control fields */
 247     wvmcs(cpu->hvf_fd, VMCS_PIN_BASED_CTLS,
 248           cap2ctrl(hvf_state->hvf_caps->vmx_cap_pinbased,
 249           VMCS_PIN_BASED_CTLS_EXTINT |
 250           VMCS_PIN_BASED_CTLS_NMI |
 251           VMCS_PIN_BASED_CTLS_VNMI));
 252     wvmcs(cpu->hvf_fd, VMCS_PRI_PROC_BASED_CTLS,
 253           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased,
 254           VMCS_PRI_PROC_BASED_CTLS_HLT |
 255           VMCS_PRI_PROC_BASED_CTLS_MWAIT |
 256           VMCS_PRI_PROC_BASED_CTLS_TSC_OFFSET |
 257           VMCS_PRI_PROC_BASED_CTLS_TPR_SHADOW) |
 258           VMCS_PRI_PROC_BASED_CTLS_SEC_CONTROL);
 259     wvmcs(cpu->hvf_fd, VMCS_SEC_PROC_BASED_CTLS,
 260           cap2ctrl(hvf_state->hvf_caps->vmx_cap_procbased2,
 261                    VMCS_PRI_PROC_BASED2_CTLS_APIC_ACCESSES));
 262
 263     wvmcs(cpu->hvf_fd, VMCS_ENTRY_CTLS, cap2ctrl(hvf_state->hvf_caps->vmx_cap_entry,
 264           0));
 265     wvmcs(cpu->hvf_fd, VMCS_EXCEPTION_BITMAP, 0); /* Double fault */
 266
 267     wvmcs(cpu->hvf_fd, VMCS_TPR_THRESHOLD, 0);
 268
 269     x86cpu = X86_CPU(cpu);
 270     x86cpu->env.xsave_buf = qemu_memalign(4096, 4096);
 271
 272     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_STAR, 1);
 273     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_LSTAR, 1);
 274     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_CSTAR, 1);
 275     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FMASK, 1);
 276     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_FSBASE, 1);
 277     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_GSBASE, 1);
 278     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_KERNELGSBASE, 1);
 279     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_TSC_AUX, 1);
 280     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_TSC, 1);
 281     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_CS, 1);
 282     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_EIP, 1);
 283     hv_vcpu_enable_native_msr(cpu->hvf_fd, MSR_IA32_SYSENTER_ESP, 1);
 284
 285     return 0;
 286 }
 287
 288 static void hvf_store_events(CPUState *cpu, uint32_t ins_len, uint64_t idtvec_info)
 289 {
 290     X86CPU *x86_cpu = X86_CPU(cpu);
 291     CPUX86State *env = &x86_cpu->env;
 292
 293     env->exception_nr = -1;
 294     env->exception_pending = 0;
 295     env->exception_injected = 0;
 296     env->interrupt_injected = -1;
 297     env->nmi_injected = false;
 298     env->ins_len = 0;
 299     env->has_error_code = false;
 300     if (idtvec_info & VMCS_IDT_VEC_VALID) {
 301         switch (idtvec_info & VMCS_IDT_VEC_TYPE) {
 302         case VMCS_IDT_VEC_HWINTR:
 303         case VMCS_IDT_VEC_SWINTR:
 304             env->interrupt_injected = idtvec_info & VMCS_IDT_VEC_VECNUM;
 305             break;
 306         case VMCS_IDT_VEC_NMI:
 307             env->nmi_injected = true;
 308             break;
 309         case VMCS_IDT_VEC_HWEXCEPTION:
 310         case VMCS_IDT_VEC_SWEXCEPTION:
 311             env->exception_nr = idtvec_info & VMCS_IDT_VEC_VECNUM;
 312             env->exception_injected = 1;
 313             break;
 314         case VMCS_IDT_VEC_PRIV_SWEXCEPTION:
 315         default:
 316             abort();
 317         }
 318         if ((idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWEXCEPTION ||
 319             (idtvec_info & VMCS_IDT_VEC_TYPE) == VMCS_IDT_VEC_SWINTR) {
 320             env->ins_len = ins_len;
 321         }
 322         if (idtvec_info & VMCS_IDT_VEC_ERRCODE_VALID) {
 323             env->has_error_code = true;
 324             env->error_code = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_ERROR);
 325         }
 326     }
 327     if ((rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 328         VMCS_INTERRUPTIBILITY_NMI_BLOCKING)) {
 329         env->hflags2 |= HF2_NMI_MASK;
 330     } else {
 331         env->hflags2 &= ~HF2_NMI_MASK;
 332     }
 333     if (rvmcs(cpu->hvf_fd, VMCS_GUEST_INTERRUPTIBILITY) &
 334          (VMCS_INTERRUPTIBILITY_STI_BLOCKING |
 335          VMCS_INTERRUPTIBILITY_MOVSS_BLOCKING)) {
 336         env->hflags |= HF_INHIBIT_IRQ_MASK;
 337     } else {
 338         env->hflags &= ~HF_INHIBIT_IRQ_MASK;
 339     }
 340 }
 341
 342 static void hvf_cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
 343                               uint32_t *eax, uint32_t *ebx,
 344                               uint32_t *ecx, uint32_t *edx)
 345 {
 346     /*
 347      * A wrapper extends cpu_x86_cpuid with 0x40000000 and 0x40000010 leafs,
 348      * leafs 0x40000001-0x4000000F are filled with zeros
 349      * Provides vmware-cpuid-freq support to hvf
 350      *
 351      * Note: leaf 0x40000000 not exposes HVF,
 352      * leaving hypervisor signature empty
 353      */
 354
 355     if (index < 0x40000000 || index > 0x40000010 ||
 356         !tsc_is_known(env) || !apic_bus_freq_is_known(env)) {
 357
 358         cpu_x86_cpuid(env, index, count, eax, ebx, ecx, edx);
 359         return;
 360     }
 361
 362     switch (index) {
 363     case 0x40000000:
 364         *eax = 0x40000010;    /* Max available cpuid leaf */
 365         *ebx = 0;             /* Leave signature empty */
 366         *ecx = 0;
 367         *edx = 0;
 368         break;
 369     case 0x40000010:
 370         *eax = env->tsc_khz;
 371         *ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
 372         *ecx = 0;
 373         *edx = 0;
 374         break;
 375     default:
 376         *eax = 0;
 377         *ebx = 0;
 378         *ecx = 0;
 379         *edx = 0;
 380         break;
 381     }
 382 }
 383
 384 int hvf_vcpu_exec(CPUState *cpu)
 385 {
 386     X86CPU *x86_cpu = X86_CPU(cpu);
 387     CPUX86State *env = &x86_cpu->env;
 388     int ret = 0;
 389     uint64_t rip = 0;
 390
 391     if (hvf_process_events(cpu)) {
 392         return EXCP_HLT;
 393     }
 394
 395     do {
 396         if (cpu->vcpu_dirty) {
 397             hvf_put_registers(cpu);
 398             cpu->vcpu_dirty = false;
 399         }
 400
 401         if (hvf_inject_interrupts(cpu)) {
 402             return EXCP_INTERRUPT;
 403         }
 404         vmx_update_tpr(cpu);
 405
 406         qemu_mutex_unlock_iothread();
 407         if (!cpu_is_bsp(X86_CPU(cpu)) && cpu->halted) {
 408             qemu_mutex_lock_iothread();
 409             return EXCP_HLT;
 410         }
 411
 412         hv_return_t r  = hv_vcpu_run(cpu->hvf_fd);
 413         assert_hvf_ok(r);
 414
 415         /* handle VMEXIT */
 416         uint64_t exit_reason = rvmcs(cpu->hvf_fd, VMCS_EXIT_REASON);
 417         uint64_t exit_qual = rvmcs(cpu->hvf_fd, VMCS_EXIT_QUALIFICATION);
 418         uint32_t ins_len = (uint32_t)rvmcs(cpu->hvf_fd,
 419                                            VMCS_EXIT_INSTRUCTION_LENGTH);
 420
 421         uint64_t idtvec_info = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 422
 423         hvf_store_events(cpu, ins_len, idtvec_info);
 424         rip = rreg(cpu->hvf_fd, HV_X86_RIP);
 425         env->eflags = rreg(cpu->hvf_fd, HV_X86_RFLAGS);
 426
 427         qemu_mutex_lock_iothread();
 428
 429         update_apic_tpr(cpu);
 430         current_cpu = cpu;
 431
 432         ret = 0;
 433         switch (exit_reason) {
 434         case EXIT_REASON_HLT: {
 435             macvm_set_rip(cpu, rip + ins_len);
 436             if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
 437                 (env->eflags & IF_MASK))
 438                 && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
 439                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
 440                 cpu->halted = 1;
 441                 ret = EXCP_HLT;
 442                 break;
 443             }
 444             ret = EXCP_INTERRUPT;
 445             break;
 446         }
 447         case EXIT_REASON_MWAIT: {
 448             ret = EXCP_INTERRUPT;
 449             break;
 450         }
 451         /* Need to check if MMIO or unmapped fault */
 452         case EXIT_REASON_EPT_FAULT:
 453         {
 454             hvf_slot *slot;
 455             uint64_t gpa = rvmcs(cpu->hvf_fd, VMCS_GUEST_PHYSICAL_ADDRESS);
 456
 457             if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
 458                 ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
 459                 vmx_set_nmi_blocking(cpu);
 460             }
 461
 462             slot = hvf_find_overlap_slot(gpa, 1);
 463             /* mmio */
 464             if (ept_emulation_fault(slot, gpa, exit_qual)) {
 465                 struct x86_decode decode;
 466
 467                 load_regs(cpu);
 468                 decode_instruction(env, &decode);
 469                 exec_instruction(env, &decode);
 470                 store_regs(cpu);
 471                 break;
 472             }
 473             break;
 474         }
 475         case EXIT_REASON_INOUT:
 476         {
 477             uint32_t in = (exit_qual & 8) != 0;
 478             uint32_t size =  (exit_qual & 7) + 1;
 479             uint32_t string =  (exit_qual & 16) != 0;
 480             uint32_t port =  exit_qual >> 16;
 481             /*uint32_t rep = (exit_qual & 0x20) != 0;*/
 482
 483             if (!string && in) {
 484                 uint64_t val = 0;
 485                 load_regs(cpu);
 486                 hvf_handle_io(env, port, &val, 0, size, 1);
 487                 if (size == 1) {
 488                     AL(env) = val;
 489                 } else if (size == 2) {
 490                     AX(env) = val;
 491                 } else if (size == 4) {
 492                     RAX(env) = (uint32_t)val;
 493                 } else {
 494                     RAX(env) = (uint64_t)val;
 495                 }
 496                 env->eip += ins_len;
 497                 store_regs(cpu);
 498                 break;
 499             } else if (!string && !in) {
 500                 RAX(env) = rreg(cpu->hvf_fd, HV_X86_RAX);
 501                 hvf_handle_io(env, port, &RAX(env), 1, size, 1);
 502                 macvm_set_rip(cpu, rip + ins_len);
 503                 break;
 504             }
 505             struct x86_decode decode;
 506
 507             load_regs(cpu);
 508             decode_instruction(env, &decode);
 509             assert(ins_len == decode.len);
 510             exec_instruction(env, &decode);
 511             store_regs(cpu);
 512
 513             break;
 514         }
 515         case EXIT_REASON_CPUID: {
 516             uint32_t rax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 517             uint32_t rbx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RBX);
 518             uint32_t rcx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 519             uint32_t rdx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 520
 521             if (rax == 1) {
 522                 /* CPUID1.ecx.OSXSAVE needs to know CR4 */
 523                 env->cr[4] = rvmcs(cpu->hvf_fd, VMCS_GUEST_CR4);
 524             }
 525             hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
 526
 527             wreg(cpu->hvf_fd, HV_X86_RAX, rax);
 528             wreg(cpu->hvf_fd, HV_X86_RBX, rbx);
 529             wreg(cpu->hvf_fd, HV_X86_RCX, rcx);
 530             wreg(cpu->hvf_fd, HV_X86_RDX, rdx);
 531
 532             macvm_set_rip(cpu, rip + ins_len);
 533             break;
 534         }
 535         case EXIT_REASON_XSETBV: {
 536             X86CPU *x86_cpu = X86_CPU(cpu);
 537             CPUX86State *env = &x86_cpu->env;
 538             uint32_t eax = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RAX);
 539             uint32_t ecx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RCX);
 540             uint32_t edx = (uint32_t)rreg(cpu->hvf_fd, HV_X86_RDX);
 541
 542             if (ecx) {
 543                 macvm_set_rip(cpu, rip + ins_len);
 544                 break;
 545             }
 546             env->xcr0 = ((uint64_t)edx << 32) | eax;
 547             wreg(cpu->hvf_fd, HV_X86_XCR0, env->xcr0 | 1);
 548             macvm_set_rip(cpu, rip + ins_len);
 549             break;
 550         }
 551         case EXIT_REASON_INTR_WINDOW:
 552             vmx_clear_int_window_exiting(cpu);
 553             ret = EXCP_INTERRUPT;
 554             break;
 555         case EXIT_REASON_NMI_WINDOW:
 556             vmx_clear_nmi_window_exiting(cpu);
 557             ret = EXCP_INTERRUPT;
 558             break;
 559         case EXIT_REASON_EXT_INTR:
 560             /* force exit and allow io handling */
 561             ret = EXCP_INTERRUPT;
 562             break;
 563         case EXIT_REASON_RDMSR:
 564         case EXIT_REASON_WRMSR:
 565         {
 566             load_regs(cpu);
 567             if (exit_reason == EXIT_REASON_RDMSR) {
 568                 simulate_rdmsr(cpu);
 569             } else {
 570                 simulate_wrmsr(cpu);
 571             }
 572             env->eip += ins_len;
 573             store_regs(cpu);
 574             break;
 575         }
 576         case EXIT_REASON_CR_ACCESS: {
 577             int cr;
 578             int reg;
 579
 580             load_regs(cpu);
 581             cr = exit_qual & 15;
 582             reg = (exit_qual >> 8) & 15;
 583
 584             switch (cr) {
 585             case 0x0: {
 586                 macvm_set_cr0(cpu->hvf_fd, RRX(env, reg));
 587                 break;
 588             }
 589             case 4: {
 590                 macvm_set_cr4(cpu->hvf_fd, RRX(env, reg));
 591                 break;
 592             }
 593             case 8: {
 594                 X86CPU *x86_cpu = X86_CPU(cpu);
 595                 if (exit_qual & 0x10) {
 596                     RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
 597                 } else {
 598                     int tpr = RRX(env, reg);
 599                     cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
 600                     ret = EXCP_INTERRUPT;
 601                 }
 602                 break;
 603             }
 604             default:
 605                 error_report("Unrecognized CR %d", cr);
 606                 abort();
 607             }
 608             env->eip += ins_len;
 609             store_regs(cpu);
 610             break;
 611         }
 612         case EXIT_REASON_APIC_ACCESS: { /* TODO */
 613             struct x86_decode decode;
 614
 615             load_regs(cpu);
 616             decode_instruction(env, &decode);
 617             exec_instruction(env, &decode);
 618             store_regs(cpu);
 619             break;
 620         }
 621         case EXIT_REASON_TPR: {
 622             ret = 1;
 623             break;
 624         }
 625         case EXIT_REASON_TASK_SWITCH: {
 626             uint64_t vinfo = rvmcs(cpu->hvf_fd, VMCS_IDT_VECTORING_INFO);
 627             x68_segment_selector sel = {.sel = exit_qual & 0xffff};
 628             vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
 629              vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
 630              & VMCS_INTR_T_MASK);
 631             break;
 632         }
 633         case EXIT_REASON_TRIPLE_FAULT: {
 634             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 635             ret = EXCP_INTERRUPT;
 636             break;
 637         }
 638         case EXIT_REASON_RDPMC:
 639             wreg(cpu->hvf_fd, HV_X86_RAX, 0);
 640             wreg(cpu->hvf_fd, HV_X86_RDX, 0);
 641             macvm_set_rip(cpu, rip + ins_len);
 642             break;
 643         case VMX_REASON_VMCALL:
 644             env->exception_nr = EXCP0D_GPF;
 645             env->exception_injected = 1;
 646             env->has_error_code = true;
 647             env->error_code = 0;
 648             break;
 649         default:
 650             error_report("%llx: unhandled exit %llx", rip, exit_reason);
 651         }
 652     } while (ret == 0);
 653
 654     return ret;
 655 }